EUVD-2026-14945Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as regular user
-
DeliverySave internal IP as notification URL
-
ExploitCron job executes sendnotifications.php
-
ExecutionRequest sent to internal network without SSRF validation
-
ImpactAccess internal services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Wallos versions prior to 4.7.0. Requires authenticated user account. Attacker saves internal/private IP address as notification URL via save* endpoints. Vulnerability triggered when scheduled cron job sendnotifications.php executes. |
| Impact | The CVSS score of 7.7 (High) reflects significant risk with network-based attack vector (AV:N), low complexity (AC:L), requiring only low privileges (PR:L), no user interaction (UI:N), and changed scope (S:C) with high confidentiality impact (C:H). The changed scope is particularly concerning as it indicates the vulnerability can affect resources beyond the vulnerable component's security scope, typical of SSRF attacks that access internal networks. However, the requirement for authentication (PR:L) provides some defense-in-depth protection against internet-wide exploitation. The vulnerability requires a cron job execution to trigger, adding a time-delay element but also making it potentially automatable once credentials are obtained. Without EPSS data, KEV listing, or public POC availability, the immediate exploitation risk appears moderate rather than critical. Real-world risk is elevated for organizations running Wallos in environments with sensitive internal services, cloud infrastructure (AWS/Azure/GCP metadata endpoints), or segmented networks where the application server has privileged network access. This is a genuine priority for Wallos deployments but not an emergency requiring immediate out-of-band patching unless internal network segmentation is weak. |
| Exploit ScenarioDerived | An authenticated attacker with low-level privileges logs into their Wallos instance and navigates to the notification configuration settings. Instead of using the test endpoint (which has SSRF protection), they directly save a notification webhook URL pointing to an internal resource such as http://192.168.1.100/admin or http://169.254.169.254/latest/meta-data/ (AWS metadata service). When the sendnotifications.php cron job executes on its scheduled interval, the application sends HTTP requests to the attacker-controlled URL without validation, potentially leaking sensitive information from internal services, cloud provider metadata containing credentials, or allowing interaction with internal APIs that trust requests from the application server's IP address. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 24, 2026
An incomplete Server-Side Request Forgery (SSRF) mitigation in Wallos, a self-hostable subscription tracker, allows authenticated attackers to bypass security controls and force the application to make requests to internal or private IP addresses. Wallos versions prior to 4.7.0 are affected. The vulnerability occurs because SSRF validation was added to test notification endpoints but not the corresponding save endpoints, enabling attackers to store malicious URLs that execute without validation when the cron job runs. No active exploitation (KEV) or public POC is currently documented.
RemediationAI
Upgrade Wallos to version 4.7.0 or later, which includes the complete SSRF validation fix as documented in the GitHub security advisory at https://github.com/ellite/Wallos/security/advisories/GHSA-mfjc-3258-cq3j. The specific patch commit can be reviewed at https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef. Until patching is completed, implement compensating controls including restricting the application's outbound network access using firewall rules or network segmentation to prevent connections to internal IP ranges (RFC 1918 addresses, link-local addresses, localhost), cloud metadata endpoints (169.254.169.254), and other sensitive internal resources. Review existing notification webhook configurations for any suspicious internal IP addresses or localhost references that may have been saved by authenticated users. Consider implementing additional application-level authentication and authorization controls to limit which users can configure notification webhooks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Wallos is a PHP-based open-source subscription tracking application identified by CPE cpe:2.3:a:ellite:wallos. This vulnerability is classified under CWE-918 (Server-Side Request Forgery), a security weakness where an attacker can abuse server-side functionality to make HTTP requests to arbitrary destinations. The issue stems from an incomplete fix for previous SSRF vulnerabilities (CVE-2026-30839 and CVE-2026-30840). While version 4.6.2 introduced the validate_webhook_url_for_ssrf() function to protect test notification endpoints, the developers failed to apply the same validation to the save notification endpoints. When authenticated users configure notification webhooks and save them through unprotected endpoints, these URLs bypass SSRF checks. The vulnerability materializes when the sendnotifications.php cron job executes, sending requests to the stored URLs without any validation, potentially targeting internal network resources, cloud metadata services, or other restricted endpoints.
Know when Wallos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the SSRF fix applied in version 4.6.2 for CVE-2026-30839 and CVE-2026-30840 is incomplete. The validate_webhook_url_for_ssrf() protection was added to the test* notification endpoints but not to the corresponding save* endpoints. An authenticated user can save an internal/private IP address as a notification URL, and when the cron job sendnotifications.php executes, the request is sent to the internal IP without any SSRF validation. This issue has been patched in version 4.7.0.
Executive ViewAI
Wallos subscription tracker versions before 4.7.0 contain an incomplete SSRF mitigation that allows authenticated users to bypass security controls and force the application to access internal or private IP addresses. This creates a pathway for lateral movement and internal reconnaissance within your network infrastructure, particularly risking access to sensitive internal services like metadata endpoints, databases, or administrative interfaces that the Wallos server can reach.
Vendor-released patch: Wallos 4.7.0. If immediate patching is not feasible, implement network-layer controls: restrict outbound connections from the Wallos server to only approved external domains using firewall rules or proxy filtering, and monitor for unexpected internal IP access attempts in application and network logs. Limit Wallos user access to trusted administrators only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Related Vulnerabilities in Wallos SSRF and XSS Vulnerabilities
View all 2Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to res
Server-side request forgery in Wallos versions before 4.6.2 allows authenticated attackers to conduct arbitrary network
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. R
Wallos versions 4.6.0 and below allow authenticated attackers to perform Server-Side Request Forgery attacks through the
Path traversal in Wallos subscription tracker versions prior to 4.6.2 allows unauthenticated remote attackers to read ar
Reflected cross-site scripting (XSS) in Wallos password reset functionality before version 4.6.2 allows unauthenticated
Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excludi
Zip Slip path traversal in Wallos's database restore endpoint allows an authenticated administrator to write arbitrary f
SSRF via admin-configurable OIDC endpoint URLs in Wallos subscription tracker allows an authenticated admin to direct th
Wallos, an open-source self-hostable subscription tracker, contains a Server-Side Request Forgery (SSRF) vulnerability i
Wallos prior to version 4.6.2 contains an authorization bypass allowing authenticated users to delete avatar files belon
Exploit-DB